Re: [PATCH v4 1/20] lsm: Refactor return value of LSM hook vm_enough_memory

[PATCH bpf-next v4 00/20] Add return value range check for BPF LSM · Xu Kuohai <xukuohai@huaweicloud.com> · 2024-07-11
[PATCH bpf-next v4 02/20] lsm: Refactor return value of LSM hook inode_need_killpriv · Xu Kuohai <xukuohai@huaweicloud.com> · 2024-07-11
Re: [PATCH bpf-next v4 02/20] lsm: Refactor return value of LSM hook inode_need_killpriv · Serge Hallyn <serge@hallyn.com> · 2024-07-11
Re: [PATCH bpf-next v4 02/20] lsm: Refactor return value of LSM hook inode_need_killpriv · Xu Kuohai <xukuohai@huaweicloud.com> · 2024-07-13
Re: [PATCH v4 2/20] lsm: Refactor return value of LSM hook inode_need_killpriv · Paul Moore <paul@paul-moore.com> · 2024-07-19
Re: [PATCH v4 2/20] lsm: Refactor return value of LSM hook inode_need_killpriv · Xu Kuohai <xukuohai@huaweicloud.com> · 2024-07-20
[PATCH bpf-next v4 05/20] lsm: Refactor return value of LSM hook inode_copy_up_xattr · Xu Kuohai <xukuohai@huaweicloud.com> · 2024-07-11
Re: [PATCH v4 5/20] lsm: Refactor return value of LSM hook inode_copy_up_xattr · Paul Moore <paul@paul-moore.com> · 2024-07-19
Re: [PATCH v4 5/20] lsm: Refactor return value of LSM hook inode_copy_up_xattr · Xu Kuohai <xukuohai@huaweicloud.com> · 2024-07-20
[PATCH bpf-next v4 08/20] lsm: Refactor return value of LSM hook getprocattr · Xu Kuohai <xukuohai@huaweicloud.com> · 2024-07-11
Re: [PATCH v4 8/20] lsm: Refactor return value of LSM hook getprocattr · Paul Moore <paul@paul-moore.com> · 2024-07-19
Re: [PATCH v4 8/20] lsm: Refactor return value of LSM hook getprocattr · Xu Kuohai <xukuohai@huaweicloud.com> · 2024-07-20
[PATCH bpf-next v4 11/20] bpf, lsm: Add disabled BPF LSM hook list · Xu Kuohai <xukuohai@huaweicloud.com> · 2024-07-11
Re: [PATCH bpf-next v4 11/20] bpf, lsm: Add disabled BPF LSM hook list · Alexei Starovoitov <hidden> · 2024-07-12
Re: [PATCH bpf-next v4 11/20] bpf, lsm: Add disabled BPF LSM hook list · Xu Kuohai <xukuohai@huaweicloud.com> · 2024-07-13
[PATCH bpf-next v4 04/20] lsm: Refactor return value of LSM hook inode_listsecurity · Xu Kuohai <xukuohai@huaweicloud.com> · 2024-07-11
Re: [PATCH v4 4/20] lsm: Refactor return value of LSM hook inode_listsecurity · Paul Moore <paul@paul-moore.com> · 2024-07-19
Re: [PATCH v4 4/20] lsm: Refactor return value of LSM hook inode_listsecurity · Xu Kuohai <xukuohai@huaweicloud.com> · 2024-07-20
[PATCH bpf-next v4 03/20] lsm: Refactor return value of LSM hook inode_getsecurity · Xu Kuohai <xukuohai@huaweicloud.com> · 2024-07-11
Re: [PATCH bpf-next v4 03/20] lsm: Refactor return value of LSM hook inode_getsecurity · Simon Horman <horms@kernel.org> · 2024-07-12
Re: [PATCH bpf-next v4 03/20] lsm: Refactor return value of LSM hook inode_getsecurity · Xu Kuohai <xukuohai@huaweicloud.com> · 2024-07-13
Re: [PATCH v4 3/20] lsm: Refactor return value of LSM hook inode_getsecurity · Paul Moore <paul@paul-moore.com> · 2024-07-19
Re: [PATCH v4 3/20] lsm: Refactor return value of LSM hook inode_getsecurity · Xu Kuohai <xukuohai@huaweicloud.com> · 2024-07-20
[PATCH bpf-next v4 01/20] lsm: Refactor return value of LSM hook vm_enough_memory · Xu Kuohai <xukuohai@huaweicloud.com> · 2024-07-11
Re: [PATCH bpf-next v4 01/20] lsm: Refactor return value of LSM hook vm_enough_memory · Serge Hallyn <serge@hallyn.com> · 2024-07-11
Re: [PATCH v4 1/20] lsm: Refactor return value of LSM hook vm_enough_memory · Paul Moore <paul@paul-moore.com> · 2024-07-19
[PATCH bpf-next v4 07/20] lsm: Refactor return value of LSM hook setprocattr · Xu Kuohai <xukuohai@huaweicloud.com> · 2024-07-11
Re: [PATCH v4 7/20] lsm: Refactor return value of LSM hook setprocattr · Paul Moore <paul@paul-moore.com> · 2024-07-19
Re: [PATCH v4 7/20] lsm: Refactor return value of LSM hook setprocattr · Xu Kuohai <xukuohai@huaweicloud.com> · 2024-07-20
[PATCH bpf-next v4 06/20] lsm: Refactor return value of LSM hook getselfattr · Xu Kuohai <xukuohai@huaweicloud.com> · 2024-07-11
Re: [PATCH v4 6/20] lsm: Refactor return value of LSM hook getselfattr · Paul Moore <paul@paul-moore.com> · 2024-07-19
Re: [PATCH v4 6/20] lsm: Refactor return value of LSM hook getselfattr · Xu Kuohai <hidden> · 2024-07-20
[PATCH bpf-next v4 09/20] lsm: Refactor return value of LSM hook key_getsecurity · Xu Kuohai <xukuohai@huaweicloud.com> · 2024-07-11
Re: [PATCH v4 9/20] lsm: Refactor return value of LSM hook key_getsecurity · Paul Moore <paul@paul-moore.com> · 2024-07-19
Re: [PATCH v4 9/20] lsm: Refactor return value of LSM hook key_getsecurity · Xu Kuohai <xukuohai@huaweicloud.com> · 2024-07-20
Re: [PATCH v4 9/20] lsm: Refactor return value of LSM hook key_getsecurity · Paul Moore <paul@paul-moore.com> · 2024-07-22
Re: [PATCH v4 9/20] lsm: Refactor return value of LSM hook key_getsecurity · Xu Kuohai <xukuohai@huaweicloud.com> · 2024-07-23
Re: [PATCH v4 9/20] lsm: Refactor return value of LSM hook key_getsecurity · Paul Moore <paul@paul-moore.com> · 2024-07-23
[PATCH bpf-next v4 10/20] lsm: Refactor return value of LSM hook audit_rule_match · Xu Kuohai <xukuohai@huaweicloud.com> · 2024-07-11
Re: [PATCH v4 10/20] lsm: Refactor return value of LSM hook audit_rule_match · Paul Moore <paul@paul-moore.com> · 2024-07-19
Re: [PATCH v4 10/20] lsm: Refactor return value of LSM hook audit_rule_match · Xu Kuohai <xukuohai@huaweicloud.com> · 2024-07-20
[PATCH bpf-next v4 12/20] bpf, lsm: Enable BPF LSM prog to read/write return value parameters · Xu Kuohai <xukuohai@huaweicloud.com> · 2024-07-11
Re: [PATCH bpf-next v4 00/20] Add return value range check for BPF LSM · Paul Moore <paul@paul-moore.com> · 2024-07-12
Re: [PATCH bpf-next v4 00/20] Add return value range check for BPF LSM · Paul Moore <paul@paul-moore.com> · 2024-07-12
Re: [PATCH bpf-next v4 00/20] Add return value range check for BPF LSM · Paul Moore <paul@paul-moore.com> · 2024-07-12
Re: [PATCH bpf-next v4 00/20] Add return value range check for BPF LSM · Paul Moore <paul@paul-moore.com> · 2024-07-19
Re: [PATCH bpf-next v4 00/20] Add return value range check for BPF LSM · Xu Kuohai <xukuohai@huaweicloud.com> · 2024-07-19

From: Paul Moore <paul@paul-moore.com>
Date: 2024-07-19 02:08:01
Also in: bpf, linux-integrity, linux-kselftest, linux-security-module, selinux

On Jul 11, 2024 Xu Kuohai [off-list ref] wrote:

To be consistent with most LSM hooks, convert the return value of
hook vm_enough_memory to 0 or a negative error code.

Before:
- Hook vm_enough_memory returns 1 if permission is granted, 0 if not.
- LSM_RET_DEFAULT(vm_enough_memory_mm) is 1.

After:
- Hook vm_enough_memory reutrns 0 if permission is granted, negative
  error code if not.
- LSM_RET_DEFAULT(vm_enough_memory_mm) is 0.

Signed-off-by: Xu Kuohai <redacted>
---
 include/linux/lsm_hook_defs.h |  2 +-
 include/linux/security.h      |  2 +-
 security/commoncap.c          | 11 +++--------
 security/security.c           | 11 +++++------
 security/selinux/hooks.c      | 15 ++++-----------
 5 files changed, 14 insertions(+), 27 deletions(-)

A nice improvement, thank you!

--
paul-moore.com

`h`	back out one level
`j`	next message in thread
`k`	previous message in thread
`l`	drill in
`Esc`	close help / fold thread tree
`?`	toggle this help